Wouldn't writing an open source program make it available for anyone to freely hack and exploit, thus making it less secure? [closed]

Question

Also, is the notion true that Linux (and even Mac os for the matter) less exploited (at least partially) because less people use it?

For the record, I've seen the following arguments:

• Linux is opensource and open software gets fixed much more quickly.
• Linux is used for 70+% of servers for a reason!
• Linux only has 1% of the market.
• Windows was built around single user privileges while Linux stores your files as root and gives the user less "control."
• Mac os X, BSD, and Linux are UNIX oses.

^ Those are arguments that I have seen, not what I am endorsing.

What I don't understand is can't someone just look at the code, make something malicious, and then release it into the wild? Someone who write malware isn't going to register a signature. In other words, if oyou write an open source program on Windows, can't someone write a virus for it more quickly because the code is displayed for all?

Answer 1

In my experience working on closed source software for a living. Companies working on closed source software generally rely on the fact that there software is closed to get away with poor security practice.

STRIDE Analysis is a system for uncovering security design flaws in software. The first principle of STRIDE Analysis is:

Open design - Assume the attackers have the sources and the specs.

Closed source software companies often ignore this and thus leave there software open to attack.

More often then not open source software gets this right. Because the source code is published they cannot get away with poor security practice and so instead design systems which don't rely on secrets in the source code or design.

Answer 2

A) is usually true. As a contradiction: bugs can go unfixed for years, but the idea is that more people have a chance to fix it.

B) That reason isn't always security. There are lots of reasons, like cost of deployment or management tools or services desired.

C) Assuming finite resources, some attackers will choose the biggest targets if they just want low-hanging-fruit. This doesn't help in the case of a targeted attack. Those are getting more common.

D) You have this "partially" right. Windows was designed to be single-user. Linux was designed to be Multi-User from the start. It doesn't 'store your files as root' however - but most programs you run are not writeable by your user account.

E) Just because it's UNIX doesn't mean it's secure:

Security isn't something you get for free - it requires effort (time/money). The idea that Linux is more secure is that more people have taken the time to make it that way.

Security is risk avoidance and is very hard to sell. The best companies can do is sell the fact that without it you lose time/money/data.

If a company spends time improving security of Linux, everyone benefits. You can improve it yourself - get the source, read the code...find a bug, test...fix, and share your results.

Other operating systems...security has to compete with other demands on programmer time at those companies. If it's more profitable to make a music store than improve security, then the OS gets a music store.

Answer 3

Well - there are two question, afaik. No. 1: What is the logical consequence from OSS for security, and No. 2: What is the real world experience (which might be influenced by other parameters, like popularity).

Free and Open Source Software (FOSS) is a wide field, and closed source software is as well. Of course, not every developer has the same level of knowledge, the same experience, the same tools, amount of time. Maybe there is just the developer and the manager, looking at the code, and for FOSS, just from the opportunity to review the code, there is no guarantee it will happen.

A popular case you could google for is the debian-SSL-debakel. It was an error in a security relevant component which could have been found for months, but wasn't.

However, if you read the mailing lists about vulnerabilities and incidents, you'll find a lot of attacks against closed source. There are a lot of tools which act on binaries, and use fuzzzy attacks, to find an error, and with success.

Single occurrences disprove only absolute claims. My answer is: The field is to heterogeneous for an answer which fits for all.

But in the field of high importance of security, the trend is more and more to use well known and public algorithms. But while the algorithm is public, the implementation needn't be.